General

  • Target

    b976f78e7ded5b6a4e5dc09885db23a0b0600fc11c1c94f237d9a0abcdd189b8

  • Size

    660KB

  • Sample

    241105-kp2cesyfml

  • MD5

    ca43f465587a7f2d7f111773de029855

  • SHA1

    16bc35f22995b6bcb848ff18c900f35cf3f89b77

  • SHA256

    b976f78e7ded5b6a4e5dc09885db23a0b0600fc11c1c94f237d9a0abcdd189b8

  • SHA512

    39f1bdf936dd7a2705cfe9eb087c199291c1d7edff6fd84e6c4f2d5d2b1c8f17a6ca44541e1f272aba0214aa32d4a9331a7f2753532d90461d802dadc2e3e411

  • SSDEEP

    12288:pMrSy905vp1EnE648Cae+BgCtI2DhwTeP8Z51rpyyEDMZAml1pl:DyGTmS8c6wQ8Z51rpyykW

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

dozt

C2

77.91.124.145:4125

Attributes
  • auth_value

    857bdfe4fa14711025859d89f18b32cb

Targets

    • Target

      b976f78e7ded5b6a4e5dc09885db23a0b0600fc11c1c94f237d9a0abcdd189b8

    • Size

      660KB

    • MD5

      ca43f465587a7f2d7f111773de029855

    • SHA1

      16bc35f22995b6bcb848ff18c900f35cf3f89b77

    • SHA256

      b976f78e7ded5b6a4e5dc09885db23a0b0600fc11c1c94f237d9a0abcdd189b8

    • SHA512

      39f1bdf936dd7a2705cfe9eb087c199291c1d7edff6fd84e6c4f2d5d2b1c8f17a6ca44541e1f272aba0214aa32d4a9331a7f2753532d90461d802dadc2e3e411

    • SSDEEP

      12288:pMrSy905vp1EnE648Cae+BgCtI2DhwTeP8Z51rpyyEDMZAml1pl:DyGTmS8c6wQ8Z51rpyykW

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

    • Healer family

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Redline family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks